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Remarks 



The present amendment is responsive to the Office Action mailed in the above- 
referenced case on January 1 1, 2006. Claims 1-32 are pending. Applicant acknowledges 
an election made on December 09, 2005 by Donald R. Boys in response to an indicated 
restriction, electing Group 1 for continued prosecution, claims 1-32 drawn to a system for 
providing network security. 

In the Office Action the Examiner objects to claim 1 for informalities. Claim 32 
is rejected under 35 U.S.C. 1 12, first paragraph as failing to comply with the enabling 
requirement. Claims 1-10, 12, 17-25 and 2 are rejected under 35 U.S.C. 102(b) as being 
anticipated by Jacobson et al. (US 6044402) hereinafter Jaoobson. Claims 1 1 -1 3 are 
rejected under 35 U.S.C. 103(a) as being unpatentable over Jacobson in view of Vaidya 
(US 62791 1 3) hereinafter Vaidya. Claims 14-16, 26 and 28-31 are rejected under 35 
U.S.C, 103(a) as being unpatentable over Jacobson in view of Joiner (US 6742128) 
hereinafter Joiner. Claims 14, 26 and 28 are further rejected under 35 U.S.C. 103(a) as 
being unpatentable over Jacobson in view Caronni (US 2002/0143850) hereinafter 
Caronni. Claims 15, 16 and 30 are further rejected under 35 U.S.C. 103(a) as being 
unpatentable over Jacobson in view of Caronni and further in view of Teixeira (US 
2005/0005145) hereinafter Teixeira. Claims 32 is rejected under 35 U.S.C. 103(a) as 
being unpatentable over Jacobson in view of Joiner and further in view of Weaver (US 
6574669) hereinafter Weaver. 

In response to the Examiner's rejections and comments applicant herein amends 
the claims to more particularly recite that the data is checked and hashed in real-time over 
live data connections and to add the checksum sliding window operation creating hash 
values in the process and the algorithm used in the calculation. Claim 32 was amended to 
overcome the 1 12 rejection which is also facilitated by the amendments to the 
independent claims. Claims 14 and 23 are herein canceled. 

The Examiner presents the art of Jacobson to read on applicant's original claim 1 . 
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The Examiner relies upon Joiner to teach additional functionality of a thiid software 
portion for detecting virus activity by hashing data passed over the connection in real time 
and for comparing the hash data to a dalaset containing virus signatures, the dataset 
searchable by hash table index, the hash entries therein derived individually from separate 
virus signatures. The above limitations were part of original claim 14. 

Applicant herein amends claim 1 to positively recite that the data connections are 
live and the sliding window determines hash values from the data in the connections in 
real time. Applicant argues that Joiner and Jacobson, either singly or in combination, fail 
to positively recite that data passing through live connections are monitored and hashed in 
real time. 

Joiner teaches that data is gathered from various network sources and stored. 
Then operations are performed on the stored data to determine connections and virus 
threats (col. 6, line 65 to col. 7, line 6; col. 7 lines 29-37; col. 8 lines 47-54). Applicant 
argues that the combination of Jacobson and Joiner fail to accomplish applicant's 
invention as claimed because live, real time data hashing is not possible. Applicant 
argues that only by utilizing applicant's unique sliding window method of determining 
hash values from live data streams can real time virus threats be determined. 

Applicant believes claim 1, as amended is clearly patentable over Jacobson and 
Joiner. Claims 2-13 and IS- 16 are patentable based on their own merits or at least as 
depended upon a patentable claim. 

Specifically regarding dependent claim 15 applicant amends the claim to 
particularly point out the detailed method used in the sliding window wherein a first hash 
value computed from a set number of consecutive bytes in the window, compared to the 
hash table index and stored, a second hash value is then computed and compared to the 
hash table index when the window slides to the next consecutive byte in the data string, 
wherein the second hash value equals the first hash value minus the byte exiting the 
window plus the next consecutive byte of the data sting entering the window, thereby 
creating a high speed search algorithm for the connection. 
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Applicant directs the Examiner's attention to figure 1 1 A of applicant's 
specification illustrating a hashing operation on a data stream according to a simplest 
embodiment of the present invention. A hash value 1 labeled (HV1) is illustrated in this 
example and represents a hash value computed from the first 9 bytes of the data string 
using a single sliding checksum window of a length equal to 9 bytes. HV1 is then 
immediately compared against the previously described hash table entry. As soon as 
HV1 exists, a hash value 2 is computed the window sliding one consecutive byte over. 
HV1 is temporarily stored when computed and then recalled to expedite computation of 
the second hash value as follows: 

Value (h2) - value (hi) - the first byte value (reversed checksum of the first 
byte of the last value) + the next consecutive byte value of the data string. 
The portion then of HVl that does not have to be recomputed is shaded black 
in this example. The use of this technique expedites hashing because 
relevant bytes from the previous hash value are not recomputed* A next 
consecutive window HV 3 is illustrated in this example for creating the third 
hash value sliding one consecutive byte over from HV2. 

Regarding claim 17, applicant herein amends the claim to include limitation from 
depended claim 23 wherein the pre-defined state or states includes one, more, or a 
combination of a banned Universal Resource Locator; a banned domain name; a detected 
virus signature; a banned port; and banned data content defined by filter. Applicant 
argues that Jacobson fails to teach said limitation. Jacobson is limited to blocking the 
connection based on the network address of the node (col. 17 lines 60-<57). 

Applicant believes claim 17, as amended, is patentable over the art of Jacobson. 
Claims 18-22 and 24-32 are patentable on their own merits, or at least as depended from a 
patentable claim. 

As all of applicant's claims are patentable over the prior art, applicant respectfully 
requests that the rejections be withdrawn and that the case be passed quickly to issue. 
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If any fees are due beyond fees paid with this amendment, authorizatioo is made 
to deduct those fees from deposit account 50-0534. If any time extension i$ needed 
beyond any extension requested with this amendment, such extension is hereby requested. 



Respectfully Submitted, 
John Alexander Bartas 

By WeagtAMttml 
Donald R, Boys 
Reg. No. 35,074 



Central Coast Patent Agency 
P.O. Box 187 
Aromas, CA 95004 
(831)726-1457 
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